402MCP.org — HTTP 402 & Agent Payment Registry

402MCP.org

The MCP server and open registry for HTTP 402 agent payments.

When an AI agent receives 402 Payment Required, 402MCP tells it which scheme the server speaks (L402, x402 or MPP), what is being asked for, and exactly how to pay and retry. When a developer is choosing how an agent should pay, or how an API should charge agents, it recommends a rail from stated requirements. Behind both sits an open registry of sourced, scored payment solutions.

• Site: https://402mcp.org
• Remote MCP endpoint: https://402mcp.org/api/v1/mcp (streamable HTTP)
• npm: @402mcp/mcp (stdio)
• Install guides: https://402mcp.org/docs#install

Install

Claude Code:

claude mcp add --transport http 402mcp https://402mcp.org/api/v1/mcp

Any stdio MCP client (Claude Desktop, Cursor, Windsurf and others):

{  "mcpServers": {    "402mcp": { "command": "npx", "args": ["-y", "@402mcp/mcp"] }  }}

MCP server

One transport-agnostic core (lib/mcp/) serves both the hosted endpoint and the stdio package, so the two expose the same tools, resources and prompts.

Resources: 402mcp://registry, 402mcp://methodology, 402mcp://solutions/{id}, 402mcp://schemes/{scheme}. Prompts: choose_payment_rail, handle_402_response. Every tool is annotated readOnlyHint.

Safety. Everything in a 402 response is server-controlled, so the decoder lists those fields in untrusted_fields and never repeats their text as instructions. It flags expired challenges and macaroons that commit to a different payment hash than their invoice. The probe refuses private, loopback, link-local and metadata addresses (including hostnames that resolve to them) and non-web ports, and the hosted endpoint rate-limits it per client. No tool can spend money.

Machine interfaces

Any page returns Markdown when requested with Accept: text/markdown.

Methodology

Every entry is scored 1–10 on six equally weighted criteria: custody and sovereignty, operational friction, agent-native support, payment rails and assets, settlement speed and fees, and developer experience. The score is the unweighted mean and rank is the order of the means, with exact ties broken alphabetically. Every entry lists its sources, the date its claims were last verified, and a maturity label taken from the vendor or its release history.

The current ranking is at https://402mcp.org and in /api/v1/registry. The full methodology is at https://402mcp.org/docs#methodology.

402MCP.org is not affiliated with, sponsored by, or compensated by any vendor it indexes, and listing position cannot be purchased. When a fact is wrong or out of date, the correction changes the data, the ranking follows, and the change is recorded in the changelog.

Development

Requires Node 18.18 or later.

npm installnpm run dev            # http://localhost:3000

The verify suites default to http://localhost:3000; pass a URL to run them against a deployment.

Deploying to Cloudflare

The site runs as a Cloudflare Worker through the OpenNext adapter. Copy wrangler.example.jsonc to wrangler.jsonc, create the KV namespace it names, and fill in your own values. Then:

npm run cf:buildnpm run cf:deploy

Project layout

data/solutions.ts     The registry dataset; scores and ranks are computed heredata/changelog.ts     Additions and corrections, with reasonslib/decode/           bech32, BOLT 11, macaroons, RFC 9110 challenges, x402, MPPlib/mcp/              Transport-agnostic MCP server: tools, resources, promptslib/recommend.ts      Requirement-driven recommendationlib/probe.ts          URL probe with SSRF guardslib/schemes.ts        Wire-format reference for each schemelib/liveness.ts       Daily docs and website checksapp/                  Next.js App Router pages and route handlersworker.ts             Worker entry: OpenNext handler plus the scheduled liveness jobpackages/402mcp/      The @402mcp/mcp stdio packageserver.json           Official MCP Registry entrytests/ · scripts/     Unit tests, verification suites and the package build

License

Code: MIT (see LICENSE). Registry data: CC BY 4.0.